Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Consider that Alice wants to send a digitally signed message to Bob. Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently valid signature.

But let's assume that Bob already has received Alice's correct public key. Can Mallory still send a fake message with a valid signature using more advanced methods?

Consider the following situation: Bob knows Alice's public key. Alice private key is secret and only known to Alice.

Mallory doesn't have Alice's private key, but he knows her public key.

Alice now sends the signed message "today is my birthday". Mallory wants to change that message to say "tomorrow is my birthday". Mallory and Alice know What is message: "today is my birthday".

Can Mallory find a way to send his fake message without Bob noticing, i.e. with a valid signature.

Could Mallory somehow compare the hash value of "today is my birthday" and the signature generated by Alice and learn from that how to generate a valid signature of "tomorrow is my birthday" under Alice's public key?

share|improve this question
Your question is basically: "Is some unspecified digital signature algorithm horribly broken?" –  David Schwartz Jul 11 '12 at 6:01
add comment

1 Answer

For the first part of your question: Yes, if Mallory manages to publish is own public key under Alice's name, then there is really nothing to stop him. This problem is addressed with public key infrastuctures and public key certificates.

That is, for Bob to believe that the public key is Alice's key, Mallory would need to have a trusted third party attest, that that's the case. As the third party is assumed to be trusted, she obviously wont attest to that false statement.

Once we've got that problem out of the way, then no, as long as you use a secure signature scheme, it is not possible for Mallory to forge a signature on any message not already signed by Alice herself.

The usual security requirement for a signature scheme is existential unforgeability under chosen message attacks. That means, Mallory can ask Alice so sign any number of messages of his choosing and he still wont be able to produce a single message signature pair, where the message has not already been signed by Alice herself.

What Mallory would need is an even stronger forgery, namely a selective forgery, because he chose the message to forge a signature for, before he even started the attack.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.